General
-
Target
Payment Swift USD45,000.zip
-
Size
483KB
-
Sample
230402-p2cl2shf8s
-
MD5
580602f533ec1d304cfa8a4cde612456
-
SHA1
b0117998ca059d5f00c631f56f8c01e316a58ce5
-
SHA256
7a3fc9a413a6a1df187dd2aec1b0e8930462fc251a1547cbced4aa907437b1ac
-
SHA512
abbd10eb4d9f1d762a6f284f6761aafa14f736a250d7c4e021b575fdc79b9ee3b834f921c8bbc5d1f65f54fb2d395ea21276da23bbda4a30922a02118a9c10ee
-
SSDEEP
12288:0Q/WBHsHs39599NZKbw0soQQpf5KwQ+3s7bjPCh+Q:0Qg3959rj0spSRKwQWybjPCh+Q
Static task
static1
Behavioral task
behavioral1
Sample
Payment Swift USD45,000.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
Payment Swift USD45,000.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.focuzpartsmart.com - Port:
587 - Username:
[email protected] - Password:
FpmJhn@2023 - Email To:
[email protected]
Targets
-
-
Target
Payment Swift USD45,000.exe
-
Size
701KB
-
MD5
2cdadb430d6398c3d479965903424159
-
SHA1
8178aa04e93d14c8c2edc4945bf3c7a7cbd94298
-
SHA256
971768aa9e6a82e0236f07d5d38e0b1d32f998619275b1b5c72b3d3540507a0b
-
SHA512
3361f46dd4bbbc2b197d1895d9fe8c622cff127f06581f283aa5c61de9598538360f2981ded126b418807db21f4bf01c1f93d0c9e23c4ca83e2d8ab3107426cc
-
SSDEEP
12288:HjHXmbxzUnxUn7bNVVebVyywVR0wKQQpf3Kws+js7bpP0XEP:7XmbCnWn+wVR0wjSfKwsIybpP0XEP
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of SetThreadContext
-